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Abstract 

For the four-state protocol of quantum key distribution, optimum 
sets of probe parameters are calculated for the most general unitary 
probe in which each individual transmitted photon is made to interact 
with the probe so that the signal and the probe are left in an entangled 
state, and projective measurement by the probe, made subsequent to 
projective measurement by the legitimate receiver, yields information 
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about the signal state. The probe optimization is based on maximizing 
the Renyi information gain by the probe on corrected data for a given 
error rate induced by the probe in the legitimate receiver. An arbitrary 
angle is included between the nonorthogonal linear polarization states 
of the signal photons. Two sets of optimum probe parameters are 
determined which both correspond to the same optimization. Also, 
a larger set of optimum probe parameters is found than was known 
previously for the standard BB84 protocol. A detailed comparison is 
made between the complete and incomplete optimizations, and the 
latter simpler optimization is also made complete. Also, the process 
of key distillation from the quantum transmission in quantum key 
distribution is reviewed, with the objective of calculating the secrecy 
capacity of the four-state protocol in the presence of the eavesdropping 
probe. Emphasis is placed on information leakage to the probe. 

Keywords: quantum cryptography, quantum key distribution, 
quantum communication, quantum information processing 
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1 INTRODUCTION 



Research efforts by many investigators have significantly advanced the field 
of quantum cryptography [1] since the pioneering discoveries of Wiesner [2] 
and Bennett and Brassard [3,4]. Emphasis has been placed on quantum 
key distribution, the generation by means of quantum mechanics of a secure 
random binary sequence which can be used together with the Vernam cipher 
(one-time pad) [5] for secure encryption and decryption. Various protocols 
have been devised for quantum key distribution, including the single-particle 
four-state Bennett-Brassard protocol (BB84) [3], the single-particle two-state 
Bennett protocol (B92) [6], and the two-particle entangled-state Einstein- 
Podolsky-Rosen (EPR) [7] protocol. However the original BB84 protocol is 
presently the most practical and robust protocol. 

One effective implementation of the BB84 protocol [3] uses single photons 
linearly polarized along one of the four basis vectors of two sets of coplanar 
orthogonal bases oriented at an angle of 45 degrees (equivalently, 7r/4) rela- 
tive to each other. The polarization measurement operators in one basis do 
not commute with those in the other, since they correspond to nonorthogo- 
nal polarization states. At a fundamental level, the potential security of the 
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key rests on the fact that nonorthogonal photon polarization measurement 
operators do not commute, and this results in quantum uncertainty in the 
measurement of those states by an eavesdropping probe [8]. Before trans- 
mission of each photon, the transmitter and receiver each independently and 
randomly select one of the two bases. The transmitter sends a single pho- 
ton with polarization chosen at random along one of the orthogonal basis 
vectors in the chosen basis. The receiver makes a polarization measurement 
in its chosen basis. Next, the transmitter and the receiver, using a public 
communication channel, openly compare their choices of basis, without dis- 
closing the polarization states transmitted or received. Events in which the 
transmitter and the receiver choose different bases are ignored, while the re- 
maining events ideally have completely correlated polarization states. The 
two orthogonal states in each of the two bases encode binary numbers and 
1, and thus a sequence of photons transmitted in this manner can establish 
a random binary sequence shared by both the transmitter and the receiver 
and can then serve as the secret key, following error correction and privacy 
amplification [9,10]. Privacy amplification is of course necessary, because of 
the possibility of an eavesdropping attack [1,3,4]. Using the Vernam cipher, 
the key can then be used to encode a message which can be securely trans- 
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mitted over an open communication line and then decoded, using the shared 
secret key at the receiver. (The encrypted message can be created at the 
transmitter by adding the key to the message and can be decrypted at the 
receiver by subtracting the shared secret key.) 

Numerous analyses of various eavesdropping strategies have appeared in 
the literature. A recent review is given in [1]. The present work is lim- 
ited to an individual attack in which each transmitted photon is measured 
by an independent probe after the photon polarization basis is revealed. In 
addition to the individual attack, other approaches include: coherent collec- 
tive attacks in which the eavesdropper entangles a separate probe with each 
transmitted photon and measures all probes together as one system; and also 
coherent joint attacks in which a single probe is entangled with the entire 
set of carrier photons. However, these approaches require maintenance of 
coherent superpositions of large numbers of states, and this is not currently 
feasible 

For the standard four-state (BB84) protocol [3] of key distribution in 
quantum cryptography, Slutsky, Rao, Sun, and Fainman [11] performed an 
eavesdropping probe optimization, which on average yields the most infor- 
mation to the eavesdropper for a given error rate caused by the probe. The 
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most general possible probe consistent with unitarity was considered [11-15], 
in which each individual transmitted bit is made to interact with the probe 
so that the carrier and the probe are left in an entangled state, and mea- 
surement by the probe, made subsequent to measurement by the legitimate 
receiver, yields information about the carrier state. The probe optimization 
is based on maximizing the Renyi information gain by the probe on cor- 
rected data for a given error rate induced by the probe in the legitimate 
receiver. A minimum overlap of the probe states which are correlated with 
the signal states (because of the entanglement) determines the maximum 
Renyi information gain by the probe. This is related to the idea that the 
more nearly orthogonal the correlated probe states are, the easier they are 
to distinguish. The upper bound an Renyi information gain by the probe 
is needed to calculate the secrecy capacity and to determine the number of 
bits which must be sacrificed during privacy amplification in order that it 
be exponentially unlikely that more than token leakage of the final key be 
available to the eavesdropper following key distillation. The results in [11] 
were obtained for the standard protocol with an angle of 45 degrees between 
the signal bases. The present work generalizes the probe optimization for 
arbitrary angle between the signal bases. 
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In Section 2, a detailed review is given of the optimization of the standard 
BB84 protocol by Slutsky et al [11]. In Section 3, the necessary conditions 
are obtained for the existence of possible extrema of the overlap of correlated 
probe states for an arbitrary angle between the signal bases. Section 4 iden- 
tifies the possible extrema and associated probe parameters, and two sets 
of optimum probe parameters are determined which both correspond to the 
optimization. Section 5 determines an analytical algebraic expression for the 
maximum Renyi information gain by the probe for fixed error rate and angle 
between the signal bases. In Section 6, the simplified approach of Slutsky 
et al, which leads to the incomplete optimization, is made complete by rec- 
ognizing certain necessary restrictions which were ignored by those authors. 
In Section 7, following a review of the process of key distillation, the secrecy 
capacity of the four-state protocol in the presence of the individual attack 
is calculated. Section 8 contains a summary. (The present work reviews the 
results of Refs. [12-14] by the author.) 
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2 PROBE OPTIMIZATION FOR STANDARD 
BB84 PROTOCOL 



In this Section, the probe optimization of [11] is addressed for the standard 
BB84 protocol in which the angle between the signal bases is restricted pre- 
cisely to 7r/4 (equivalently, a = n/8 in Fig. 2 of [11]). From Section IV and 
Table II of [11], one has for the induced error rate E in the receiver by the 
eavesdropping probe, 



where Pij is the probability that if a photon in polarization state \i > is 
transmitted in the presence of the disturbing probe, the polarization state 
\j > is detected by the legitimate receiver, where {i,j} = {u,ii,v,v} cor- 
responds to nonorthogonal polarization states \u > and \v >, and the state 
| u> orthogonal to \u >, and | v> orthogonal to \v >. The states \u > and 
\v > both correspond to Boolean state |1 >, and | u> and | v> correspond 
to Boolean state 10 >. 



E 




uu ' uu 



(1) 



One has 



(2) 
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where M«j) is the projected state of the probe when polarization state \i) 
is transmitted, and polarization state \j) is detected by the receiver in the 
presence of the probe [11]. 

From Eqs. (1) and (8) of [11], it follows that 

\*i>ui) = {u\U\u®w), (3) 

where U is the unitary operator producing the entanglement of the probe 
state \w) with the signal states, or 

M««) = (~ ( e o| sin a + (e\ \ cos a) U (|e ) cos a + \ei) sin a) ® \w) , (4) 

where |e ) and M) are orthogonal basis vectors in the plane of the polariza- 
tion states of the signal, \w) is the initial state of the probe, and a — \ (f — 0) 
is half the complement of the angle 0— cos -1 (< u\v > /MM) between the 
two nonorthogonal linear-polarization states \u) and \v) of the signal (see 
Fig. 2 of [11]; I also refer to Q as the angle between the two orthogonal bases 
{\u) , \u)} and {\v) , \v)}.) Using Eq. (2) of [11] in Eq. (4), one obtains 

M««) = (~ ( e o| sina + (ei| cosa) I cosa ^ \e n ) ® |$ „) + sina ^ l e «) ® 

\ n n 

(5) 

where |$ mn ) are the unnormalized nonorthogonal states of the probe. Equa- 
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tion (5) becomes 

l^uu) — l^oi) cos 2 a - I $10) sin 2 a + (|$n) - |$oo)) sin a cos a, (6) 

and substituting Eq. (6) in Eq. (2), and using the symmetry properties of the 
probe states [11,15,16], and Eqs. (3a), (3b), and (12) of [11], one obtains 

P u5 = 1(1 - d) + I(d - a) sin 2 2a - ^csin 2a. (7) 

where a, b, c,and d, expressed in terms of the eavesdropping probe parameters 
A, /i, 9, and 0, are given by [11,15,16] 

a = sin 2 A sin 2/i + cos 2 A cos 29 sin 20, (8) 

b = sin 2 A sin 2/i + cos 2 A sin 20, (9) 

c = cos 2 A sin 29 cos 20, (10) 

d = sin 2 A + cos 2 A cos 29, (11) 

Summarizing Eq. (7) , along with other results in Appendix C of [11], one 
has 

Pun = ^(1 +d) - hd - a) sin 2 2a + ^csin2a, (12) 
P u - = - d) + ±(d - a) sin 2 2a - ^csin 2a, (13) 
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P-uu = ^ ~ d ) + 2^ _a ) sin2 2«+ 2 csin2a ' 



^ii = ^ + d ) _ 2^ d ~ ^ Sin2 2a ~ 2 Csin2a ' 



(14) 
(15) 



Substituting Eqs. (12)-(15) in Eq. (1), one obtains 

1 



E — - 
2 



1 — d + (d — a) sin 2a 



(16) 



Also from Section IV of [11], one has for the overlap Q of the probe states 
correlated with the signal received by the legitimate receiver: 



or equivalently, using Eqs. (2) in Eq. (17), one obtains 

(P P-) 1/2 ' 

I- 1 uu uu) 

From Appendix C of [11], one also has 



(17) 



(18) 



= |$oo)cos 2 a + |$n)sin 2 a+ (|$ 10 ) + |$ i)) sin a cos a, (19) 



and 



IVw) = |$n)cos 2 a+ |$ 00 )sin 2 a - (|$i ) + |$oi)) sinacosa. (20) 

Using Eqs. (19), (20), the symmetry properties [11,15,16] of the probe states 
and Eqs. (12), (3a), (3b) of [11], one obtains 

(Vwfc) = \{ a + h ) + a ) sin2 2 «- ( 21 ) 
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Next, substituting Eq. (21), (12) and (15) in Eq. (18), one obtains 



Q = \ (a + b) + (d — a) \ sin 2 2a \ (1 + d) + (— d + a)\ sin 2 2a + c\ sin 2a 



x 



|(1 + d) + (-d + a)\ sin 2 2a - c\ sin 2a 



(22) 



in agreement with Eq. (15) of [11]. The optimum information gain I^ pt by 
the probe is given in terms of the overlap Q of correlated probe states by 



C = log 2 (2 - Q 2 ) 



(23) 



(for the BB84 protocol, as well as the B92 protocol) [11,16-18]. It follows 
that I^ pt is maximized when Q is minimized. 

It is of interest to first limit the analysis to the standard BB84 protocol 
in which a = tt/8, corresponding to a 45-degree angle (6= n /2 — 2a = n/A) 
between the signal bases and also between the two nonorthogonal polariza- 
tion states \u) and \v) of the signal, namely, (u\v) = cos 0= cos (| — 2aj = 
sin2a = cos (j^j = 2~ 1 / 2 . The conditional optimization in [11] is limited to 
this case. In that case, Eqs. (16) and (22) become 



En = E 



|a=7r/8 



l--(d + a) 



(24) 
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and 



Qo = Q\a=ir/8 



\ (d + a) + b 



1 + Ud + a) 



1-2 



1/2 ' 



(25) 



respectively, in agreement with Eqs. (15) of [11]. Substituting Eq.(24) in 
Eq. (25), the latter becomes 

1 - 2E + b 



Qo 



(2 - 2E f 



1-2 



1/2 : 



(26) 



also in agreement with Eq. (15) of [11]. 

For any value of E , the numerator of Eq. (26) has a conditional (fixed E ) 
minimum at some point where the denominator has a conditional maximum, 
namely, c = 0. (This is further substantiated in the following.) Clearly, the 
numerator of Eq. (26) for fixed E is minimum when b is minimum. Before 
minimizing 6, substituting Eqs. (8) and (11) in Eq. (24), one obtains 



or 



1 1 r 

E = sin 2 A (1 + sin 2/i) + cos 2 A cos 20 (1 + sin 20) 

2 4 



. nl 2-4£ -sin 2 A(l + sin2u) 

sm2< ^ = ~\ ^ L 

cos z A cos 20 



(27) 



(28) 



Next substituting Eq. (28) in Eq. (9), in order to eliminate the variable 0, 



one gets 



b = sin 2 A sin 2/i + 



2-4£ -sin 2 A(l + sin2At) 
cos 26 



cos A. 



(29) 
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In order that b be minimum, so that Qo can be minimum in Eq. (26), one 
requires that b in Eq. (29) satisfy 



and 



db 

ex = °- 



db 



Substituting Eq. (29) in Eqs. (30), (31), and (32), one requires 



sin 2 A cos In, (l -] = 0, 

P V cos 20 J 

sin 2A (sin 2u + l — \ = 0, 

V cos 20 J 



sin 20 

cos 2 20 



2-4£o-sin 2 A(l + sin2//) 



= 0. 



(30) 
(31) 



(32) 



(33) 

(34) 
(35) 



Equations (33)-(35) are necessary conditions for minimum b and Q 
Equation (33) requires 



ia 



sin A = 



(36) 



or 



(ib) 



cos2/i = 



(37) 
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or 



(ic) cos2# = 1. 

Equation (34) requires 

(iia) sin 2A = 



or 



(iib) sin 2/i = — 1 



or 



(iic) cos20 = l. 

Equation (35) requires 

(iiia) sin2# = 



or 



(iiib) sin 2 A (1 + sin 2/i) = 2 - AE . 

A solution to Eqs. (33)-(35), which leads to the optimization given 
is given by 

sin A = 0; sin 26 = 0; cos 26 = e e = ±1. 
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Equations (44) satisfy Eqs. (ia), (iia), and (iiia), and therefore also Eqs. (33)- 
(35). Next, substituting Eqs. (44) in Eq. (10), one gets 

c = 0, (45) 

consistent with the conditional maximum of the denominator in Eq. (26), as 
declared above. 

Furthermore, substituting Eqs. (44) in Eq. (28), one obtains 

sin 20 = — {1-2E ) - 1. (46) 
e e 

Since only E < 1/2 is considered [11], and clearly E > 0, then one requires 

< E < 1/2. (47) 

Then substituting Eq. (46) in Eq. (47), one requires 

< e e (sin 20+ 1) < 2. (48) 

Clearly one requires e e = +1 because if eg = —1, then Eq. (48) implies 
sin2(/? < —1, which is impossible. Therefore, one has in Eq. (44), 

cos20 = e e = l, (49) 

and Eq. (48) becomes 

-Ksin20<l. (50) 
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Next substituting Eqs. (44) and (49) in Eqs. (8)— (11), one requires 

a = sin 20, (51) 

b = sin 20, (52) 

c = 0, (53) 

and 

d=l. (54) 

(Equation (53) restates Eq. (45).) Next substituting Eqs. (51) and (54) in 
Eq. (24), one obtains 

E = -(1- sin 20), (55) 

and therefore 

sin2y9 = 1 -4£ - (56) 
Also, substituting Eqs. (52), (53) and (56) in Eq. (26), one obtains 

g ° =3 ~i~W (57) 

Equations (57), (44), (49), and (50)-(55) agree with Eqs. (16) of [2]. The 
choice of /i — in [11] is allowed because ji only enters through a and b in 
Eqs. (8) and (9), and according to Eq. (44), sin A = 0. In general, however, 
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any /i (0 < fi < ir) produces the same optimization. Also, A = n satisfies 
Eq. (44) as well as A = 0. Other combinations of Eqs. (36)-(43) may also 
yield solutions, and this issue is addressed in Section 4 for arbitrary values 
of a. 

It is also well to further clarify the arguments of Appendix E in [11]. Note 
that according to Eq. (9) above, b is independent of 9, and E in Eq. (27) is 
clearly least when cos 29 = 1, since in the last term of Eq. (27), cos 2 A > 0, 
and according to Eq. (50), < (1 + sin 20) < 2. But then substituting 
Eq. (49) in Eq. (27), the latter becomes 

1 1 r i 
Eq = 1 + sin 2 A sin 2/1 + cos 2 A sin 20 . (58) 

Substituting Eq. (9) in Eq. (58), then 

E = 1 -[l-b], (59) 

which agrees with Eqs. (52) and (55). According to Eq. (59), E is a mono- 
tonically decreasing function of b, and the problem of minimizing b, subject 
to constant E, can be inverted so that E is minimized, subject to con- 
stant b. One also sees by substituting Eqs. (59) and (53) in Eq. (26) that 
Eq. (57) is again obtained, and since Eq. (57) results from minimizing b with 
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Eq constant, this is equivalent to minimizing E with b constant, and is con- 
sistent with Appendix E of [11]. This approach to the optimization is further 
examined in section (6). 



3 Extrema and Probe Parameters 

In this Section, conditions for possible relative extrema are calculated of 
the overlap of correlated probe states of the Fuchs-Peres probe [11,15] for 
an arbitrary angle between the signal bases. Although the standard BB84 
protocol with angle 7r/4 between the signal bases will be seen to yield the 
most information to the probe, sensitivity to practical tuning variations in 
this angle can be useful in quantifying tolerances. First, Eq. (22) can be 
rewritten as 



Q = 



\(a + b) + (d- a) | sin 2 2a 



(60) 




\ l + d+(a — d) sin 2 2a - \c 2 sin 2 2a 




Also, from Eq. (16), it follows that 



(d - a) sin 2 2a = 2E - 1 + d, 



(61) 
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and substituting Eq. (61) in Eq. (60), one obtains 



\{a + b + d-l) + E 
|(1 — E) 2 — \c 2 sin 2 2a) 

From Eq. (61), it follows that 



2E - 1 + a sin 2 2a 

« — tt; • (63) 

cos 2 2a v ; 



Next, using Eqs. (8), (9), and (63), and defining a quantity q to be [a + b + d\, 
one can show that 

q = a + b + d= (2 — tan 2 2a) sin 2 A sin 2\x 

+ cos 2 A sin 20 [1 + (1 - tan 2 2a) cos 29] - M^. 



(64) 



Next substituting Eqs. (8) and (11) in Eq.(16), one has 



E = \ 1 - sin 2 A - cos 2 A cos 29 

+ sin 2 2a (sin 2 A + cos 2 A cos 29 — sin 2 A sin 2/j — cos 2 A cos 29 sin 2(f?j 

(65) 

It then follows from Eq. (65) that 
sin2u = 

(66) 

cos 2 A(l-cos 26»)+sin 2 2o(sin 2 A+cos 2 A cos 26— cos 2 A cos 20 sin2</>)-2£ 

sin 2 2a sin 2 A 

Next substituting Eq. (66) in Eq. (64) to eliminate dependence on fx, it follows 
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that 

q = a + b + d = cos 2 A {(2 - tan 2 2a) [cot 2 2a - cos 29 (sin 20 + cot 2 2a)} 
+ sin 20 [1 + (1 - tan 2 2a) cos 29]} - 4 esc 2 2a £ + 3. 

(67) 

Also, substituting the definition of q, Eq. (64) in Eq. (62), one obtains 

Q = - + £ „„ , (68) 

(1 — E) 2 — \c 2 sin 2 2a] ' 

where q is given by Eq. (67), c is given by Eq. (10), and E is constant. Since 

q and c depend only on A, 9, and 0, and since E is constant, then Q depends 

only on the variables A, 9, and 0. 

Possible extrema of the overlap Q for fixed E must satisfy 

(70) 

In general, Eqs. (69)-(71) may determine absolute or relative maximum, min- 
imum, or saddle points in the space of probe parameters. The minimum Q 
is sought here. Possible solutions to Eqs. (69)-(71), giving the values of the 
probe parameters at the possible extrema, are derived in the Appendix. Each 
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possible solution corresponds to one of the combinations given by Eqs. (A- 
39)-(A-50), in which the fractions F 1 ,F 2 , and F 3 are defined by Eqs. (A-5), 
(A-10), and (A- 15), respectively 

4 OPTIMUM PROBE PARAMETERS 

Possible solutions to Eqs. (69)-(71) summarized in the Appendix by Eqs. 
(A-39)-(A-50) are designated by possibilities (A)-(L), respectively. 

Possibilities (A), (C), (D) and (J) are excluded in the Appendix. Possibil- 
ities (B), (E)-(I), (K), and (L) all gave the same result, Eq. (A-60). However 
they differ in the values of the optimized probe parameters. 

First consider possibility (B). According to Eqs. (A-51), (A-54), and (A- 
55), one has for the probe parameters A, //, 9, and (f>: 

sinA = 0, (72) 

cos20 = l, (73) 

sin 20= l-2£csc 2 2a. (74) 

Evidently, according to Eqs. (72) and (66), the probe parameter \i is arbitrary 
(0 < n < 7r). In summary then for possibility (B), the optimized probe 
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parameters are: 

{A, fi, 9, 0; sin A = 0, cos 29 = 1, sin 20 = 1 - 2E esc 2 2a} . (75) 
Next consider possibility (E). According to Eqs. (A-134) and (A-135), one 

has 

cosA = 0, (76) 

sin 2/i = 1 — 2E esc 2 2a. (77) 

Evidently 9 and are arbitrary (0 < 9 < 7r, < < 7r). Thus for possibility 
(E), the optimized probe parameters are 

{A, fi, 9, 0; cos A = 0, sin 2/i = 1 - 2£ esc 2 2a} . (78) 

For possibility (F), according to Eqs. (A-141), (A- 146), (A-143), and (A- 
147), the optimized probe parameters are: 

|A, /i, 9, 0; sin 2/i sin 2 A = 1 - 2E esc 2 2a =F cos 2 A, cos 29 = 1, sin 20 = ±l} . 

(79) 

For possibility (G), according to Eqs. (A- 148), (A-150), (A-152), and (A- 
154), the optimized probe parameters are: 

{A, fi, 9, 0; cos A = 0, sin 2/i = 1 - 2E esc 2 2a, cos 29 = l} , (80) 
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or 

|A, /i, 9, 0; cos A = 0, sin 2/j, — 1 - esc 2 2a, sin 20 = 1 - 2 cot 2 2a, cos 2# = 

(81) 

Equations (80) and (81) are apparently included in Eq. (78). 

For possibility (H), according to Eqs. (A-160) and (A-162), one has 

{\,fi,9,(/>; sin 2/x sin 2 X — 1 — 2E esc 2 2a - cos 2 A sin 20, cos2# = l}. (82) 

Evidently Eqs. (75) and (79) are included in Eq. (82). 

For possibility (I), according to Eqs. (A-163), (A-165), (A-167), and (A- 
168), one has 

{A, fi, 9, 0; cos A = 0, sin 2/x = 1 - 2E esc 2 2a, cos 29 = l} , (83) 
or, alternatively, 

| A, fi, 9, 0; cos A = 0, sin 2/x = 1 - 2E esc 2 2a, sin 20 = 1-2 cot 2 2a| . 

(84) 

Equations (83) and (84) are evidently included in Eq. (78). 

For possibility (K), according to Eqs. (A-174), (A-177), and (A-179), the 
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optimum probe parameters are: 

[A, /i, 0, 0; cos A = 0, sin 2/i = 1 - 2E esc 2 2a, sin 20 = 1-2 cot 2 2a} . 

(85) 

Comparing Eq. (85) with Eq. (78), it is evident that Eq. (85) is included in 
Eq. (78) 

Finally, for possibility (L), according to Eqs. (A-186), (A-188) and (A- 
189), the optimum probe parameters are 

| A, /i, 8, 0; sin 2/i sin 2 A = 1 — 2E esc 2 2a — cos 2 A sin 20, cos 29 = 1, 
cos 2 A = 2 (1 - E) 2 (1-2 cot 2 2a - sin 20) 
x sin 2 2a cos 2 20 [1 + (1 - 2 esc 2 2a) E\ ' 



(86) 

Comparing Eqs. (86) with Eq. (78), one sees that Eq. (86) is included in 
Eq. (82). 

Equations (78) and (82) are different possible sets of optimized probe 
parameters, both of which correspond to the same optimization, Eq. (A-60). 
In summary, the optimized sets of probe parameters are: 

{A, fi, 6, 0; cos A = 0, sin 2/i = 1 - 2E esc 2 2a] , (87) 

{A,/i,#,0; sin 2/i sin 2 A = 1 - 2E esc 2 2a - cos 2 A sin 20, cos2# = l}. (88) 
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For a = 7r/8, these reduce to 



{A, /i, 9, 0; cos A = 0, sin 2/x = 1 — 4_E} , 



(89) 




Equation (90), for sin A = 0, corresponds to the standard optimization in [2] 
and in Section 2 above, but, other than that, the two sets of optimized probe 
parameters given by Eqs. (89) and (90) were not found by the simplified 
arguments appearing there. (Still another set of solutions, holding only for 
a = 7r/4, follows from Eq. (A-173), and is addressed in Section 6.) Both 
Eqs. (89) and (90) (together with Eqs. (8)-(ll), (24), and (26)) yield Eq. (57). 
It can also be shown that all sets of optimum probe parameters following from 
Eqs. (36)-(43) are subsets of Eq. (88), and also yield Eq. (57). 



5 MAXIMUM INFORMATION GAIN 



In Section 4 and the Appendix, it was determined that the only remaining 
possible extremum of the overlap Q of correlated probe states for fixed error 
rate E is given by Eq. (A-60), namely, 



Q = 



l + (l-2csc 2 2a)£ 
1-E 



(91) 
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I have found that if one plots points using the general expression for the 
nonoptimized overlap given by the parametric Eqs. (60) and (16) along with 
Eqs. (8)— (11) for a representative range of values of the error rate E and the 
probe parameters A, fi, 9, and 0, for a range of a < n/8, the nonoptimized 
values of Q all lie above the corresponding curves given by Eq. (91). Also, by 
explicitly calculating the difference between the optimized overlap, Eq. (91), 
and the nonoptimized overlap, Eqs. (60) and (16), for representative ranges 
of the error rate and the probe parameters in the neighborhood surrounding 
each of the optimized sets, Eqs. (87) and (88), I have found that for a = n/8 
or 7r/9, the nonoptimized overlap is not decreasing, and therefore Eq. (91) 
does in fact represent a minimum. Also, it is evident from Eq. (91) that the 
minimum overlap Q, for constant E, decreases as a decreases below 7r/8. 
Apparently, the optimization holds for a < ir/8. However, for a > 7r/8, 
this is not the case (points resulting from Eqs. (60) and (16) fall above and 
below the curves given by Eq. (91)), and therefore the extremization does 
not correspond to a minimum for a > n/8. (For example, if a = n/8 + 10~ 6 , 
E = 0.2, n/n = 0.156816, A/vr = 0.3, 9/n = 0.1, and 0/tt = 0.75, one 
obtains, using Eqs. (16), (60), and (8)-(ll), the value Q = 0.500003 for the 
nonoptimized overlap; but Eq. (91) yields a larger value, Q = 0.500004. Also, 
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if a = tt/5, E = 0.3, fi/ir = 0.0711275, A/tt = 0.7, 9/n = 0.7, and 0/tt = 0.7, 
one obtains Q = 0.34828 for the nonoptimized overlap, but Eq. (91) yields 
Q = 0.909509.) 

However, it is at this point essential to note the invariance of the Error 
rate E, Eq. (1), and the overlap Q, Eq. (17), under an interchange of the 
states \u) and \u); thus 

{E,Q} — » {E,Q}. (92) 

|m)<-> \u\ 

Also, from Fig. 2 of [11], it is evident that under the interchange of \u) and 
\u), the angle Q between the nonorthogonal polarization states becomes 2a; 
thus 



6 — >_ 2a, (93) 

|u)<-» \u) 



or equivalently, since Q= \ — 2a, 



a — >■ a. (94) 



\u)~\u) 4 

Also, using Eq. (94), one has 



{a<7r/8} — ► {«>tt/8}. (95) 

It then follows from Eqs. (91), (94), and (95) that the optimum overlap, 
^ l + (l-2csc 2 2a)E 

Q = 1 X _ E — , a<7r/8, (96) 
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becomes 

1 + fl -2 esc 2 2 (\ -a)) E 
Q = ^ — a>vr/8, (97) 

or equivalently, 

„ 1 + (1 - 2 sec 2 2a) £ . . . 

Q = 1 — a > tt/8. (98) 

Also, the optimized sets of probe parameters, Eqs. (87) and (88), namely, 

{A, fi, 9, 0; cos A = 0, sin 1\i = 1 - 2E esc 2 2a} , a < tt/8, (99) 

|A, /x, 6 1 , 0; sin2/isin 2 A = 1 — 2E esc 2 2a — cos 2 A sin 20, cos 29 = l} , a < 7r/8, 

(100) 

become, for a — > | — a : 

{A,/x,^,0; cos A = 0, sin2/i = 1 - 2£sec 2 2a} , a > tt/8, (101) 

|A, fi, 9, 0; sin 2fi sin 2 A = 1 - 2E sec 2 2a - cos 2 A sin 20, cos 29 = l} , a > n/8. 

(102) 

I have found that if one plots points using the general expression for the 
nonoptimized overlap, given by the parametric Eqs. (60) and (16) along with 
Eqs. (8)— (11), for a representative range of values of the error rate E and 
the probe parameters A, fi, 9, and 0, for a range of a > tt/8, the nonopti- 
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mized values of Q all lie above the corresponding curves given by Eq. (98). 
Apparently, for a > 7r/8, the optimization, Eq. (98), holds. 

With the restrictions on a, the maximum Renyi information gain by the 
probe is given by Eq. (23), namely, [11-14] 



C = log 2 (2-Q*), 



(103) 



where Q is given by Eq. (96) for a < 7r/8, and Eq.(98) for a > 7r/8, or 



Q 



l+(l-2csc 2 2a)£; . 

v 1=1 — — , " < tt/8 

l+(l-2scc 2 2a)£ 

Thus for the BB84 protocol, one has 

'l+('l-2csc 2 2a )E 



(104) 



1 opt — ^ 



log 2 [2 - 
log 2 (2 - 



i 2 N 



1-E 



l+(l-2scc 2 2a)£ 



-i 2N 



, a < tt/8 
, a > tt/8 



(105) 



For a = 7r/8, Eq. (105) produces Fig. 6 of [11], as it must. Also, I^ pt in 
Eq. (105) increases as a decreases below ir/8, or increases above n/8. As is 
to be expected, it is also evident from Eq. (105). that the standard BB84 
protocol with a = n/8 yields less information than for any other value of a. 
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6 OPTIMIZATION COMPARISON 

As reviewed above in Section 2, Slutsky, et al [11] had earlier argued that 
for the standard BB84 protocol (with a = vr/8), the optimum set of probe 
parameters is given by (See Eqs. (16) of Ref. [11].): 

{A, fJL,e,<f); A = 0, fi = 0, cos 29 = 1, sin 20 = 1 - 4E} . (106) 

In obtaining Eq. (106), Slutsky et al made certain simplifying assumptions, 
based on the algebraic form of the overlap function, which yielded the correct 
maximum Renyi information gain, but an incomplete set of optimum probe 
parameters. In this section, a detailed comparison is made between the 
optimization of Ref. [11] and the complete optimization of Section 5. 
A solution to Eqs. (33)-(35), and (28) is 

{A,/i,#,0;sinA = 0,cos2# = 1, sin 20 = 1 - AE} . (107) 

Note that Eqs. (107) and (10) give c = 0, consistent with the above. Since 
fi enters Eqs. (26) and (24) only through the term sin 2 A sin 2fi in Eqs. (8) 
and (9), and since sin2/xsin 2 A = 0, the choice sin2/i = yields a possible 
solution, which when combined with Eq. (107) gives the set 

{A, fi, 9, 0; sin 2/x = 0, sin A = 0, cos 29 = 1, sin 20 = 1 - 4E} , (108) 
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consistent with Eq. (106) and a subset of Eq. (90). 

It is to be noted that a more general solution to Eqs. (33)-(35) is given 

by 

6; cos 29 = 1} , (109) 
which when combined with Eq. (28) yields 

{A, li, 6, 0; cos 29 = 1, sin 2li sin 2 A = 1 - AE - cos 2 A sin 20 } , (110) 

coinciding with Eq. (90). One therefore sees that even with the assumptions 
of Ref. [11], a more general set than Eq. (106) obtains, namely, Eq. (110). 
Furthermore, to obtain a more complete optimization, one must consider the 

case 

cosA = 0, (111) 

in which case Eq. (28) is not defined. Instead, using Eqs. (8), (11) and (24), 
one obtains 

sin 2 A sin 2ll = 1 — AE + cos 2 A [1 — cos 2$ (1 + sin 20)] , (112) 
and substituting Eq. (112) in Eq. (9), one gets 

b = 2 - AE - cos 2 A cos 26 (1 + sin 20) - sin 2 A + cos 2 A sin 20. (113) 
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For minimum b, one then requires 

db db db , 

aT ' aA= ' m = - (114) 

Therefore substituting Eq. (113) in Eqs. (114), one obtains 

cos 2 A (1 - cos 29) cos 20 = 0, (115) 

sin A cos A (1 + sin 2(f)) (1 - cos 29) = 0, (116) 

cos 2 A (1 + sin 20) sin 29 = 0. (117) 

One observes that Eqs. (115)— (117) are in fact satisfied by Eq. (Ill), and 
from Eqs. (Ill) and (112), one obtains the optimization, Eq. (89), 

{A, fi, 9, 0; cos A = 0, sin 2/x = 1 - 4E} , (118) 

which is the missing set in the optimization of Ref. [11]. 

It is evident that Eqs. (115)— (117) are also satisfied by sin 20 = —1, and 
combining this with Eq. (112), one obtains an additional set of optimum 
probe parameters: 

{A,/i,#,0;sin20 = -1, sin 2// sin 2 A = 1 - 4£ + cos 2 A} . (119) 

This solution was also not obtained in Ref. [11]. It is at this point impor- 
tant to note that, since the analysis in Sections 3 and 4 and Ref. [12] was 
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performed for arbitrary a, the possible solution given by Eq. (A-48) was 
ignored because it followed from Eq. (A-173) that a = n/8 and = —1 are 
required. However, if a — 7r/8, then Eqs. (A-48) and (57) are satisfied for 
the set of probe parameters given by Eq. (119). 

Also, Appendix E of Ref. [11] addresses an alternative simplification of the 
optimization problem, which is reviewed in the above at the end of Section 2. 
The problem is inverted so that E is minimized subject to constant b, arguing 
that the conditional minimum of E is a monotonically decreasing function 
of b for the domain of interest (0 < E < 1/2). In Eq. (59) E is seen to be a 
monotonically decreasing function of b, as claimed in Appendix E of Ref. [11]. 
Furthermore, since in this case cos2# = 1, then, together with Eq. (112), one 
obtains the set of optimum probe parameters, 

{A, fi, 6, 0; cos 26 = 1, sin 2/i sin 2 A = 1 - AE - cos 2 A sin 20 } , (120) 

in agreement with Eq. (90). However, the optimization given in Ref. [11], 
namely Eq. (106) above, is a subset of Eq. (120). Furthermore, if the multi- 
plier cos A of cos 2$ in Eq. (27) is vanishing, then cos 26 = 1 does not neces- 
sarily produce the best E . Thus if 

cosA = 0, (121) 
34 



then combining this with Eq. (27) yields the optimum set, 

{A, n, 9, 0; cos A = 0, sin 2/x = 1 - 4E} , (122) 

which is again the missing set, Eq. (89). 

Also, if sin 20 = —1, then the multiplier of cos 29 in Eq. (27) is again 
vanishing, and then cos 29 = 1 does not necessarily produce the best E , but 
sin 20 = — 1 along with Eq. (27) again leads to the optimization given by 
Eq. (119). It can also be shown that cos 29 = 0, for which Eq. (28) is also 
not satisfied, leads to no additional optimimum sets of probe parameters. 

7 SECRECY CAPACITY 

The maximum Renyi information gain, Eq. (105), can be used to calcu- 
late the secrecy capacity of the four-state protocol in the presence of the 
individual attack. Before calculating the secrecy capacity, a review of key 
distillation is at this point appropriate. Let m bits of raw data be received 
by the legitimate receiver in the four-state quantum-key-distribution proto- 
col, and suppose n bits of sifted data remain following removal of (m — n) 
inconclusive bits, and suppose there are er bits of erroneous data, leaving 
(n — ex) bits of corrected data. Corrected data includes data remaining af- 
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ter discarding inconclusive results and also erroneous data as determined by 
block checksums and bisective search. Privacy amplification is the procedure 
for obtaining a more secure, but shorter, key. This is achieved by removing 
from the (n — e^) bits of corrected data a number s of bits (the privacy 
amplification compression level) that is the sum of the possible contributions 
to information leakage. There then remain (n — ct — s) bits, and this is the 
size of the final key. The privacy amplification compression level s is given 



where q is the estimated information leakage during error correction, v is the 
estimated leakage from any multi-photon bits, g is an extra safety margin, 
and t(n, ct) is the defense function. The defense function, in general, depends 
on the size n of the sifted data, and on the number ct of errors, and is chosen 
appropriately by the legitimate users, in order to effectively defend against an 
eavesdropping attack. The defense function t(n, ex) is the estimated upper 
bound on possible information leakage through eavesdropping on the quan- 
tum channel. Quantitatively it is determined by the maximum total Renyi 
information gain 1^ by the eavesdropping probe. (It is proved in [11] that 



by [19] 




(123) 
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the optimum individual attack maximizes both the Renyi and Shannon infor- 
mation gain by the eavesdropping probe.) The maximum Renyi information 
gain by the eavesdropper is based on minimizing the overlap of the measured 
probe states correlated with the disturbed signal states of the legitimate re- 
ceiver, conditional on fixed induced error rate. The compression level s must 
be chosen so that the probability is small that I? > tinker)- An attack is 
successful if it introduces errors on the n bits of sifted data, and yields 
a Renyi information ifi > t(n, e T ) on the (n — ex) bits of corrected data. 
The probability of a successful attack must be negligible. In the presence of 
noise and channel losses, it is not sufficient, for the security of a quantum 
key distribution system, to detect eavesdropping. It must be insured that 
the shared data is sufficiently secure. 

It is well to recall the privacy amplification theorem [9]. First, however, 
recall the definition of the Renyi information I R (l) on an I bit string X having 
probability distribution P X (X), namely, 

I R (l) = I + log 2 (P X (X)} = I + log 2 £ P 2 X (X), (124) 

x 

where the bracket denotes the expectation value. (P X (X) is often referred to 
as the collision probability.) The privacy amplification theorem states that 
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if the eavesdropper's Renyi information gain I R (l) on an I bit data string is 
less than some quantity r, namely, 



then the eavesdropper's Shannon information I H {l — s) on the reduced (l — s) 
bit string, averaged over the choice of privacy amplification hash function, is 
bounded above, namely, 



where here the brackets denote the average. By choosing the compression 
level s sufficiently large, the exponent on the right hand side of Eq. (126) 
becomes sufficiently negative that the average Shannon information can be 
made arbitrarily small. Thus, given an upper bound on the Eavesdropper's 
Renyi information gain, the corrected data can be subjected to the reduction 
procedure of privacy amplification to yield an even shorter string on which 
the eavesdropper's Shannon information is arbitrarily low. The secrecy of 
the final key is recovered (but reduced in size) if an upper bound can be 
determined on the maximum Renyi information gain by the eavesdropper on 
corrected data. 



(0 < r, 



(125) 




(126) 



38 



The average secrecy capacity C' s of a quantum cryptosystem is the number 
of secret bits produced per bit from the transmitter, and is given by 

C' a =Lim( n - eT - 8 ). (127) 

Here the limit of a very long transmission is understood in which m, the 
number of bits of raw data, is very large. 

The numerator of Eq. (127), (n — e T — s) , is the size of the final key, 
where n is the number of bits of sifted data with the inconclusive bits re- 
moved, ex is the number of bits of erroneous discarded data due to error 
correction, and s is the privacy amplification compression level. The average 
secrecy capacity, Eq. (127), converges in distribution to [19] 

C- = (JL\ h - (£l\ _ ^ Llm . (128) 

\mi V \ni n n ~\ n / m^oo \ n /J 
The factor in Eq. (128) is the conclusive rate. Since the inconclusive 
rate R? is 1/2 for the BB84 protocol [11,19], and remains unchanged in 
the presence of the individual attack, the conclusive rate must also be 1/2, 
namely, 




(129) 
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Also in Eq. (128), \ff / is the average intrinsic error rate, and is the 
average information leakage during error correction. Since the present work 
focuses on the information leakage through eavesdropping (represented by the 
third term in Eq. (128)), possible additional terms, (— (v/n)) and (— (g/n)), 
are dropped in Eq. (128) (See Eq. (123)). In the third term of Eq. (128), 

\ e T _ / e T \ IS the average defense frontier tp evaluated at the average intrin- 

sic error rate. In the individual attack, each signal is attacked individually 
and in the same way, and it is assumed that the signal states, errors, and 
measurement outcomes of the probe and the legitimate receiver are all inde- 
pendently and identically distributed [19]. Multiple eavesdropping strategies 
are considered with different induced error rates, but the attack is restricted 
to the set of strategies yielding the greatest attainable expected Renyi infor- 
mation gain for a given expected error rate. The defense frontier tp is, for all 
possible eavesdropping strategies, the upper bound on the information leak- 
age through eavesdropping, based on an optimal eavesdropper in the limit of 
a long transmission. The defense frontier tp is chosen to minimize the chance 
of any successful eavesdropping strategy, and, for the individual attack, it is 
given by [19] 
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^(n,e T )=max|n(l-^^ t (^ + e)+e 



n 2 ( 1 - - 

n 



lV2' 



(130) 



where 7^ (-E) is the maximum Renyi information gain on corrected data by 
the eavesdropping probe, and conditional on fixed error rate E = (e/n); and 
£ is defined by 

^^perf-^l-p), (131) 

where erf -1 denotes the inverse standard error function. The standard error 
function erf (z) is defined by 

2 r 

erf(z) = -= / e~ y2 dy. (132) 
Jit J 



Also in Eq. (131), p is the probability for successful eavesdropping (7^ > 
t(n, ex)) on (n — ex) bits of corrected data and producing errors; and p can 
be made arbitrarily small. The defense frontier, Eq. (130), was determined by 
Slutsky, Rao, Sun, Tancevski, and Fainman [19] by clever use of the central 
limit theorem of probability theory, and is constructed to minimize the chance 
of successful eavesdropping. Using Eqs. (128)-(130), the asymptotic secrecy 
capacity, in the limit of long transmission with m — > oo, n — > oo, and £ — > 0, 
and for q = 0, becomes [19] 
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C^o^oo^o = Ul-E- max (1 - E')I^ t (E')) , (133) 

^ \ E <E J 

where E is the error rate, and (max /(#')) denotes the maximum value of a 

x'<x 

function f(x') for x' < x. Also in Eq. (133), I^ t (E') is the maximum Renyi 
information gain on corrected data by the eavesdropping probe, conditional 
on fixed error rate E' . The asymptotic secrecy capacity, Eq. (133), is based on 
the definition of average secrecy capacity, Eq. (127), as given in the literature 
[19], however it is important to emphasize that the condition of maximum 
Renyi information gain by the eavesdropper may be overly conservative (See 
Section VI of Bennett, et al [9]). 

Substituting Eq. (105) in Eq. (133), one obtains for the asymptotic secrecy 
capacity [13]: 



Cslg=0,ra->oo,£->0 



Ul-E- max (1 - E') log 2 

Ul-E- max (l-£')log 2 
V e'<e 



l+(l-2csc 2 2a)E 



l+(l-2scc 2 2a)E 

- 1 \-e! 



, a < vr/8 

, a > tt/8 

(134) 



For a = 7r/8, Eq. (134) also agrees with [19]. It is evident from Eqs. (104), 
(105), and (134) that as a function of a, for fixed error rate, the overlap of 
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correlated probe states is greatest, the Renyi information gain by the probe 
is least, and the secrecy capacity is greatest for a = n/8, which corresponds 
to the standard BB84 protocol [3] with Q= ir/A. 

8 SUMMARY 

The maximum Renyi information gain, Eq. (105), by a Fuchs- Peres probe 
[11,15] is calculated for varying angle between the signal bases in the four- 
state protocol [3] of quantum key distribution. Two sets of optimized probe 
parameters, Eqs. (99) and (100) for a < 7r/8, and Eqs. (101) and (102) for 
a > 7r/8, are found to yield the optimization. Only a subset of one of 
these sets was found previously [11], for a = 7r/8 (Eq. (100) with sin A = 
and a = ir/8, or equivalently Eq. (90) with sin A = 0). When the angle 
between the signal bases is the standard 45 degrees (a = vr/8), the result 
of Slutsky, Rao, Sun, and Fainman [11] is recovered. Also, it was shown by 
explicit calculations that Eq. (105) gives the maximum information gain by 
the probe for a representative range of values of a. Also, the maximum Renyi 
information, Eq. (105), for constant error rate, increases as a decreases below 
7r/8, or increases above ir/8. 
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Also for a = ir/8, an additional set of optimum probe parameters, Eq. 
(119) previously ignored, has been found. A detailed comparison has been 
made between the optimizations of Ref. [12] and Ref. [11]. The reasons why 
the optimization of Ref. [11] (Eq. (106) above) did not yield the complete set 
of optimum probe parameters are because, in one approach considered there, 
the restriction in applicability of Eq. (28) was ignored. Also the parameter /i 
was unecessively restricted in Eq. (106). 

Next, following a review of the process of key distillation from the quan- 
tum transmission in quantum key distribution, the asymptotic secrecy ca- 
pacity, Eq. (134), of the four-state protocol has been calculated for the case 
of an individual attack in which the eavesdropping probe is entangled with 
the signal states, and states of the probe become correlated with the states 
measured by the legitimate receiver. The calculation generalizes earlier work 
to include an arbitrary angle between the signal bases. 
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A Possible Extrema 

In this appendix, the sets of conditions for the existence of possible extrema 
of the overlap of correlated probe states are determined by using Eqs. (69)- 
(71). Also, the possible extrema and the associated probe parameters are 
calculated. First, substituting Eq. (68) in Eq. (69), one obtains 

dq q-l + 2E , 2 dc 

+ t — : — : Tsm 2a c— = 0. (A-l) 



<9A 



4(1 - E) - c 2 sin 2 2a 



Using Eqs. (67) and (10), it follows that 



|f = -2 (cos A sin A) {(2 - tan 2 2a) [cot 2 2a - cos 26 (sin 20 + cot 2 2a)] 
+ sin 20 [1 + (1 - tan 2 2a) cos 26]}, 

(A-2) 

dc 

c— = -2 cos 3 A sin A sin 2 26 cos 2 20. (A-3) 

OA 

Then substituting Eqs. (A-2) and (A-3) in Eq. (A-l), one requires 

sin A cos XF 1 (A, 6, 0) = 0, (A-4) 

where 

F 1 (A, &,(/)) = 2 {(2- tan 2 2a) [cot 2 2a - cos 26 (sin 20 + cot 2 2a)] 

+ sin 20 [1 + (1 -tan 2 2a) cos 2^]} ( A "5) 
+ ln 2 l% 1+ 2 E) -2 9 sin 2 2a cos 2 A sin 2 26 cos 2 20. 

4(1— E)-*—c 2 sin 2a ™ 
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Next, substituting Eq. (68) in Eq. (70), one obtains 



dq 

de 



q-l + 2E 



4(1 - Ef - c 2 sin 2 2a 



sm 2a c- 



Using Eqs. (67) and (10), it follows that 



% = 2 sin 26 cos 2 A f sin 20 + 2 cot 2 2a - 1 
39 v 



dc 

c— = 2 sin 29 cos A cos 29 cos 2 26. 
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Then substituting Eqs. (A- 7) and (A-8) in Eq. (A-6), one 



sin 29 cos 2 AF 2 (A,#,0) = 0, 



where 



F 2 (A,0,0) = 2 (sin 20 + 2 cot 2 2a- 1) 

+ r ? 2 ^ 1+ ? 2i;) 2 i sin 2 2a cos 2 A cos 29 cos 2 



Next, substituting Eq. (68) in Eq. (71), one obtains 



i) H i • 21: . , 

+ t ^ t sm 2a c 



•90 4(l-E) 2 -c 2 sin 2 2a 



dc 
90 



Using Eqs. (67) and (10), one gets 



dq 

d0 



2 cos 2 A cos 20(1 - cos 29) , 
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c— = -2 cos 4 A sin 2 29 sin 20 cos 20. (A-13) 

(70 

Then substituting Eqs. (A- 12) and (A-13) in Eq. (A-ll), one requires 

cos 2 A cos 20F 3 (A, 9, 0) = 0, (A-14) 

where 

F 3 (\,9,<j>) = 2(1 - cos 29) 

(A-15) 

Summarizing Eqs. (A-4), (A-9), and (A-14), possible extrema of the over- 
lap of correlated probe states are determined by 

(a) sin A cos AF X (A, 9, 0) = 0, (A-16) 

(b) sin2#cos 2 AF 2 (A,#,0) = 0, (A-17) 

(c) cos 2 A cos 20F 3 (A, 9, 0) = 0. (A-18) 
Three possible ways of satisfying Eq. (A-16) are 

(al) sinA = 0, (A-19) 

(a2) cosA = 0, (A-20) 

(a3) F 1 = 0. (A-21) 
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Two possible ways of satisfying Eq. (A-19) and (A-17) are 

(all) sinA = 0, sin2fl = 0, (A-22) 

(al2) sinA = 0, F 2 = 0. (A-23) 

Two possible ways of satisfying Eqs. (A-22) and (A-18), and therefore also 
Eqs. (A-16) and (A-17), are 

(alll) sinA = 0, sin2# = 0, cos20 = O, (A-24) 

(all2) sinA = 0, sin2# = 0, F 3 = 0. (A-25) 

Two possible ways of satisfying Eqs. (A-23) and (A-18), and therefore also 
Eqs. (A-16) and (A-17), are 

(al21) sinA = 0, cos20 = O, F 2 = 0, (A-26) 

(al22) sinA = 0, F 2 = 0, F 3 = 0. (A-27) 

Equation (A-20) satisfies Eq. (A-17) and (A-18). Therefore, another way 
of satisfying Eqs. (A-16)-(A-18) is 

(a2) cos A = 0. (A-28) 

Three possible ways of satisfying Eqs. (A-21) and (A-17) are 

(cl) Fi = 0, sin2^ = 0, (A-29) 
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(c2) Fi = 0, cosA = 0, (A-30) 

(c3) F 1 = 0, F 2 = 0. (A-31) 

Three possible ways of satisfying Eqs. (A-29) and (A-18), and therefore also 
Eqs. (A-16) and (A-17), are 

(ell) Fi=0, sin2# = 0, cos20 = O, (A-32) 

(cl2) Fi = 0, sin2# = 0, cosA = 0, (A-33) 

(cl3) Fi = 0, sin2# = 0, F 3 = 0. (A-34) 

Eq. (A-30) satisfies Eq. (A-18), and therefore, another way of satisfying Eqs. (A- 
16)-(A-18) is 

(c2) Fi = 0, cosA = 0. (A-35) 

Three possible ways of satisfying Eqs. (A-31) and (A-18), and therefore also 
Eqs. (A-16) and (A-17), are 

(c31) Fi = 0, ^2 = 0, cos20 = O, (A-36) 

(c32) F 1 = 0, F 2 = 0, cos A = 0, (A-37) 

(c33) Fi = 0, F 2 = 0, F 3 = 0. (A-38) 
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Summarizing Eqs. (A-24)-(A-28) and (A-32)-(A-38), possible solutions 



to Eqs. (A-16)-(A-18) are determined by 

(A) sin A = 0, sin 26 = 0, cos 20 = 0, (A-39) 

(B) sinA = 0, sin2# = 0, F 3 = 0, (A-40) 

(C) sinA = 0, cos20 = O, F 2 = 0, (A-41) 

(D) sinA = 0, F 2 = 0, F 3 = 0, (A-42) 

(E) cos A = 0, (A-43) 

(F) sin2# = 0, cos20 = O, F : = 0, (A-44) 

(G) cosA = 0, sin2# = 0, F l = 0, (A-45) 

(H) sin2# = 0, Fi = 0, F 3 = 0, (A-46) 

(I) cosA = 0, Fi = 0, (A-47) 
(J) cos20 = O, Fi = 0, F 2 = 0, (A-48) 
(K) cosA = 0, Fi = 0, F 2 = 0, (A-49) 
(L) F 1 = 0, F 2 = 0, F 3 = 0. (A-50) 

First consider possible extrema determined by possibility (B), Eq. (A-40): 

sinA = 0, (A-51) 
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sin2# = 0, (A-52) 

F 3 = 0. (A-53) 
From Eqs. (A-15), (A-52) and (A-53), it follows that 

cos20 = l. (A-54) 

Substituting Eqs. (A-51) and (A-54) in Eq. (66), it follows that 

sin 20 = 1 - 2E esc 2 2a. (A-55) 

Next substituting Eqs. (A-51), (A-52), and (A-54) in Eqs. (8)-(ll), one ob- 
tains 

a = sin 20, (A-56) 

b = sin 20, (A-57) 

c = 0, (A-58) 

d=l. (A-59) 

Then substituting Eqs. (A-55)-(A-59) in Eq. (62), one obtains 

Q = L±11^!M£. (A . 60 ) 
1 — E 

For a = 7r/8, Eq. (A-60) becomes Eq. (57), corresponding to the standard 
BB84 optimization [11], as must be the case. 
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Next, consider possibility (A), given by Eq. (A-39): 



sin A = 0, 



sin 29 = 0, 



cos 20 = 0. 



From Eqs. (A-62) and (A-63), it follows that 



cos 29 = e$, 



and 



sin 20 = e<£, . 



where 



e e = ±1, 



±1. 



(A-61) 

(A-62) 
(A-63) 



(A-64) 



(A-65) 



(A-66) 



Substituting Eqs. (A-61), (A-64), and (A-65) in Eq. (65), then one requires 



E= 2 



1 — e e + e e (1 — e^) sin 2 2a 



(A-67) 



Next substituting Eqs. (A-61)-(A-66) in Eqs. (8)— (11), one obtains 

a = eee<p, 

b = e^, 
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(A-68) 
(A-69) 



c = 0, (A- 70) 

d = eg. (A-71) 
Then substituting Eqs. (A-67)-(A-71) in Eq. (62), one obtains 



q = e (l + e e ) + e e (l -e^)sin 2 2a 
(1 + eg) - eg (1 - e^) sin 2 2a 



For e e = ±1 and e = +1, Eq. (A-72) yields 

Q = l. (A-73) 

For = ±1 and = —1, Eq. (A-72) yields 

Q = -1. (A-74) 

One concludes that possibility (A), Eq. (A-39), does not yield the minimum 
overlap. 

Next, consider possibility (C), given by Eq. (A-41): 

sinA = 0, (A- 75) 

cos20 = O, (A-76) 

F 2 = 0. (A-77) 
Next, substituting Eqs. (A-10) and (A-76) in Eq. (A-77), one obtains 

sin 20 = 1 - 2 cot 2 2a. (A-78) 
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Then combining Eqs. (A- 76) and (A- 78), one requires: 



and therefore, using Eq. (A-66), one requires = — 1, and 

a = 7r/8. 

Furthermore, using Eqs. (A-75), (A- 76), and (A-80) in Eq. (66), 

Therefore possibility (C) does not yield a solution. 
Next consider possibility (D), given by Eq. (A-42): 



cot 2 2a = - (1 - e^) , 



sin A = 0, 



F 2 = 



F 3 = 



0. 



Using Eqs. (A-82) and (10), one has 



c = sin26 l cos 20. 



Also, using Eqs. (A-83) and (A-10), one requires 



q - 1 + 2E 



1 - 2 cot 2 2a - sin 20 



4(1 — E) 2 



2 — c 2 sin 2 2a 



sin 2 2a cos 2$ cos 2 20 
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Also, Eqs. (A-84) and (A-15) require 



q - 1 + 2E 



4 (1 - E) 2 - c 2 sin 2 2a 



1 - cos 29 



sin 2a sin 29 sin 20 



Furthermore using Eq. (A-82), Eq. (67) becomes 

q = {2- tan 2 2a) [cot 2 2a - cos 29 (sin 20 + cot 2 2a)] 

+ sin 2(f) [1 + (1 - tan 2 2a) cos 20] - 4£ esc 2 2a + 3. 

Next equating Eqs. (A-86) and (A-87) requires 

(1-2 cot 2 2a - sin 20) sin 2 29 sin 20 

= (1 - cos 29) cos 29 cos 2 20. 



(A-87) 



(A-88) 



(A-89) 



Next, multiplying Eq. (66) by sin 2 A and substituting Eq. (A-82), one gets 



cos 29 = 



1 - 2E 



1 - sin 2 2a (1 - sin 20) 



(A-90) 



Then substituting Eq. (A-90) in Eq. (A-89), one obtains 



(1-2 cot 2 2a - sin 20) sin 20 



x 



1 - sin 2 2a (1 - sin 20)] 2 - (1 - 2£) 2 } 

(1-2E) cos 2 20 [l - sin 2 2a (1 - sin 20) - (1 - 2E) 



(A-91) 
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or equivalently, 



1 - sin 2 2a (1 - sin 20) - (1 - 2E)\ {(1 - 2E) cos 2 20 

- (1 - 2 cot 2 2a - sin 20) sin 20 [l - sin 2 2a (1 - sin 20) + (1 - 2E)\ } = 0. 

(A-92) 

Therefore, either 



l-sin 2 2a(l-sin20)-(l-2£) = 0, 



(A-93) 



or else, 



(1 - 2E) cos 2 20 - (1 - 2 cot 2 2a - sin 20) sin 20 



x 



1 - sin 2 2a (1 - sin 20) + (1 - 2E) 



0. 



Equation (A-93) gives 



(A-94) 



sin 20 = 1 - 2£csc 2 2a, 



(A-95) 



which when substituted in Eq. (A-90) gives 



cos 29 = 1, 



(A-96) 



and substituting Eqs. (A-82), (A-95), (A-96) and (8)-(ll) in Eq. (62), one 
again obtains the same solution resulting from possibility (B), Eqs. (A-55)- 
(A-60). However Eq. (A-95) must also be compatible with the remaining 
requirements if possibility (D) is to represent a solution. 
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Alternatively, one has Eq. (A-94), which becomes the cubic: 



cti sin 3 20 + a 2 sin 2 20 + 03 sin 20 + a 4 = 0, 



where 



ai = sin 2a, 



a2 = 3 — 4 sin 2a, 



a 3 = (2E - cos 2 2a - l) (l - 2 cot 2 2a) , 



a 4 = (1-2S). 



The possible solutions to the cubic Eq. (A-97) are given by 



sin 2<p = x , 

^ 3' 



sm20 = x+ - -, 

. p 
sin 20 = x_ — -, 



where 



x = c + + c_ , 



1 3 1 / 2 



5 

± 

2 



T + 27 J 



1/2' 



1/3 
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A = l(3q-p 2 ), 
B = ±- (2p 3 - 9pq + 27r) , 



a 2 

P = —, 
ai 

a 3 

9 = — , 
ai 

04 
ai' 



(A-108) 
(A-109) 
(A-110) 
(A-lll) 
(A-112) 



Next, substituting Eqs. (A-85) and (A-90) in Eq. (A-87), one obtains 

2E - sin 2 2a (1 - sin 20) 

x { \2E - sin 2 2a (1 - sin 20)] sin 2 2a cos 2 20 + [l - sin 2 2a (1 - sin 20) 
x (q - 1 + 2E) sin 2 2a sin 20} 



All - E) 2 - [ 2 ( 1-B )- sin22Q ( 1_sin2 ^ 

^ ' [l-sin 2 2a(l-sin2</>)]^ 



= 0. 



Therefore, either 



2£-sin 2 2a(l -sin 20) = 0, 



(A-113) 



(A-114) 



or else, 



x 



4 (1 - E) 2 = [gilzghf^! 2a (l-sin20)] 
[l-sin 2 2a(l-sin20)] 2 

{[2£- sin 2 2a (l-sin 20) sin 2 2a cos 2 20 + 1 — sin 2 2a (1 — sin 20) 
x (q-l + 2E) sin 2 2a sin 20} . 

(A-115) 
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Equation (A-114) gives 

sin 20 = 1 - 2£csc 2 2a, (A-116) 

which together with Eqs. (A-90), (A-82), (8)-(ll), and (62) again yields the 
same result as possibility (B), Eqs. (A-55)-(A-60). However, Eqs. (A-95) and 
(A-116) must also be compatible with the remaining restrictions, if possibility 
(D) is to represent a solution. 

Alternatively, one has Eq. (A-115). The quantity q appearing in Eq. (A- 
115) and given by Eq. (A-88) reduces using Eq. (A-90) to 



1 + sin 20 )(1-2E) 

g = sin20+^^ '—. A-117 

cos 2 2a + sin 2 2a sin 20 



Then substituting Eq. (A-117) in Eq. (A-115), one obtains the cubic: 

&iA 3 + b 2 A 2 + 6 3 A + b A = 0, (A-118) 

where 

A = cos 2 2a + sin 2 2a sin 20, (A-119) 
6i = (1 -2E) (l -2 esc 2 2a) , (A-120) 
b 2 = 4(1 - Ef - sin 2 2a + (1 - 2Ef (1-2 esc 2 2a) 

(A-121) 

-(1 - 2E) (1 + cos 2 2a - 4 cot 2 2a) , 
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b 3 = -(1 - 2E) 2 (l + cos 2 2a - 4 cot 2 2a) + (1 - 2£) cos 2 2a (l - 2 cot 2 2a) , 

(A-122) 

6 4 = (1 - 2Ef (l-2 cos 2 2a cot 2 2a) . (A-123) 

(In obtaining Eq. (A-118), an overall factor of A was removed and ignored, 
since A = can only be satisfied if E = 1/2.) 

Next, substituting Eqs. (A-85), (A-90) and (A-117) in Eq. (A-86), leads 
to the quint ic: 

d sin 5 20 + c 2 sin 4 20 + c 3 sin 3 20 + c 4 sin 2 20 + c 5 sin 20 + c 6 = 0, (A- 124) 



where 



ci = sin 2a, 



(A-125) 



c 2 = sin 4 2a (5 cos 2 2a + 2E - 2) , (A-126) 

c 3 = sin 4 2a (5 - 12 E + 8E 2 ) - sin 2 2a cos 2 2a(l - 2E) - 2 sin 2 2a (1 - 2E) 2 
—2 sin 4 2a cos 2 2a + 5 sin 2 2a cos 4 2a — sin 6 2a, 



(A-127) 



c 4 = (1 - 2 cot 2 2a) [sin 2 2a(l - 2Ef - 4 sin 4 2a(l - Ef + sin 6 2a 
- sin 2 2a cos 4 2a] - 2 sin 4 2a cos 2 2a - sin 4 2a(l - 2Ef 
+ sin 4 2a (1 - 2E) + 8 sin 2 2a cos 2 2a (1 - E) 2 , 



(A-128) 
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c 5 = (1 - 2 cot 2 2a) [-8 sin 2 2a cos 2 2a(l — E) 2 + 2 sin 4 2a cos 2 2a 
+4 cos 4 2a (1 - E) 2 + sin 2 2a (2 - sin 2 2a) (1 - 2E) 2 
+ sin 2 2a cos 2 2a(l - 2E) - sin 2 2a cos 4 2a, 



(A-129) 



c 6 = (1 - 2 cot 2 2a) [sin 2 2a cos 4 2a - 4 cos 4 2a(l - Ef - sin 2 2a(l - 2E) 

+ sin 4 2a(l -2E) 2 . 

(A-130) 

In summary, the possibility (D) requires that one of the following three 
sets of equations be satisfied: 

(i) Eqs. (A-97), (A-118), and (A-124); (A-131) 

(ii) Eqs. (A-95), (A-118), and (A-124); (A-132) 

(Hi) Eqs. (A-95) and (A-124). (A-133) 

But none of these alternatives, (i), (ii), or (iii) can be satisfied. It can be 
shown numerically that Eqs. (A-97), (A-118), and (A-124) cannot be simul- 
taneously satisfied. Evidently, it can also be shown numerically that Eqs. (A- 
95) and (A-124) cannot be simultaneously satisfied. (This has been verified 
explicitly for a = 7r/9, tt/8, and n/5.) Thus, possibility (D) apparently does 
not produce a solution. 
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Next, consider possibility (E), given by Eq. (A-43): 

cosA = 0. (A-134) 

Substituting Eq. (A-134) in Eq. (66), one has 

sin 2/j = 1 - 2E esc 2 2a. (A-135) 

Next substituting Eqs. (A-134) and (A-135) in Eqs. (8)— (11), one obtains 

a = 1 - 2£csc 2 2a, (A-136) 

b= 1 -2£csc 2 2a, (A-137) 

c = 0, (A-138) 

d=l. (A-139) 

Then substituting Eqs. (A-136)-(A-139) in Eq. (62), one again obtains Eq. (A- 
60). Therefore, possibility (E), Eq. (A-43), gives the same result as possibility 
(B), Eq. (A-40). Note however that the probe parameter /x is restricted by 
Eq. (A-135), and the probe parameter is unrestricted, while for possibility 
(B), is restricted by Eq. (A-55), and /i is unrestricted. This is addressed in 
Section 4. 
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Next, consider possibility (F), given by Eq. (A-44): 

sin2fl = 0, (A-140) 

cos29 = e e , (A-141) 
cos20 = O, (A-142) 
sin20 = e^, (A-143) 
F l = 0. (A-144) 
Substituting Eqs. (A-5), and (A-140)-(A-143) in Eq. (A-144), one requires 

(1 - e e ) [e cot 2 2a (2 - tan 2 2a) + l] = 0, (A-145) 

and therefore 

e e = 1. (A-146) 

Next substituting Eqs. (A-141), (A-146), and (A-143) in Eq. (66), one gets 

. n sin 2 2a (1 - e^cos 2 A) - 2E ,. „ A „. 

sin2/i = v 9 — . A-147 

^ sin 2 2a sin 2 A v ; 

Then substituting Eqs. (A-140)-( A-143), (A-146) and (A-147) in Eqs. (8)- 
(11), one again obtains Eqs. (A-136)-(A-139), and (A-60). Thus possibility 
(F), Eq. (A-44), also gives the same result as possibility (B), Eq. (A-40). Note 
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however that the probe parameters ji and A are restricted by Eq. (A- 147). 
This is addressed in Section 4. 

Next consider possibility (G), given by Eq. (A-45): 

cosA = 0, (A-148) 

sin 2# = (A-149) 

cos2# = e , (A-150) 

F 1 = 0. (A-151) 
Substituting Eq. (A-148) in Eq. (66), one gets 

sin 2/i = 1 — IE esc 2 la. (A-152) 

Substituting Eqs. (A-5) and (A-148)-(A-150) in Eq. (A-151), one obtains 

(1 - e e ) [sin 20 + cot 2 2a (2 - tan 2 2a)] = 0. (A-153) 

Therefore, one requires 

ee = 1, (A-154) 

or alternatively, 

sin 20 = l-2cot 2 2a. (A-155) 
65 



Substituting Eqs. (A- 148), (A-149), and (A-152) in Eqs. (8)-(ll), one again 
obtains Eqs. (A-136)-(A-139) and (A-60). The differing values of the probe 
parameters are addressed in Section 4. 

Next consider possibility (H), given by Eq. (A-46): 

sin 29 = (A-156) 

cos2# = e , (A-157) 

Fi = 0, (A-158) 

F 3 = 0. (A-159) 
Substituting Eqs. (A-15) and (A-156) in Eq. (A-159), one gets 

cos20 = l, (A-160) 

and therefore 

e e = 1 (A-161) 

in Eq. (A-157). Next using Eqs. (A-5) and (A-160), one sees that Eq. (A-158) 
is satisfied. Also, substituting Eq. (A-160) in Eq. (66), one obtains 

sin 2 2a ( 1 - cos 2 A sin 2(f)) - 2E 

sin2u = i 5 TT — '- . A-162 

P sin 2 2a sin 2 A v ; 
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Then substituting Eqs. (A-156), (A-160), and (A-162) in Eqs. (8)-(ll), one 
again obtains Eqs. (A-136)-(A-139) and (A-60). The differing values of the 
probe parameters are addressed in Section 4. 

Next consider possibility (I), given by Eq. (A-47): 

cosA = (A-163) 

Fi = 0, (A-164) 
Substituting Eqs. (A-163) in Eq. (66), one gets 

sin 2fi =1 — 2E esc 2 2a. (A-165) 

Next substituting Eqs. (A-5) and (A-163) in Eq. (A-164), one obtains 

(1 - cos 29) [sin 20 + 2 cot 2 2a - l] = 0. (A-166) 

Therefore one requires 

cos20 = l, (A-167) 

or else, 

sin 20 = 1 - 2 cot 2 2a. (A-168) 

Using Eqs. (A-163), (A-165), and (A-167) or (A-168) in Eqs. (8)-(ll), one 
again obtains Eqs. (A-136)-(A-139) and (A-60). The differing values of the 
probe parameters are addressed in Section 4. 
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Next consider possibility (J), given by Eqs. (A-48): 



cos 20 = 0, 



(A-169) 



sin 20 = e^, 



(A-170) 



F 1 = 



(A-171) 



F 2 = 



0. 



(A- 172) 



Then substituting Eqs. (A-10) and (A-170) in Eq. (A-172), one gets 



which cannot be satisfied for arbitrary a. Therefore possibility (J) cannot 
represent a solution for arbitrary a. (It is to be noted however that Eq. (A- 
173) is satisfied if e p — — 1, and a = ir/8. This particular case is addressed 
in Section 6, following Eq. (119).) 

Next consider possibility (K), given by Eqs. (A-49): 



cot 2 2a = - (1 - e ) , 



(A- 173) 



cos A = 0, 



(A- 174) 



Fi = 0, 



(A- 175) 



0. 



(A-176) 
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Substituting Eqs. (A-10) and (A-174) in Eq. (A-176), one obtains 

sin 20 = 1 - 2 cot 2 2a. (A-177) 

Next substituting Eqs. (A-5), (A-174), and (A-177) in Eq. (A-175), one gets 
the trivial identity: 

(2 - tan 2 2a) [cot 2 2a - cos 29 (1 - cot 2 2a)] 

+ (1 - 2 cot 2 2a) [1 + (1 - tan 2 2a) cos 29] = 

(A-178) 

for any cos 29. Then substituting Eq. (A-174) in Eq. (66), one obtains 

sin 2/i =1 — 2E esc 2 2a, (A-179) 

and, using Eqs. (A-174), (A-179), (8)-(ll), and (62), then Eqs. (A-136)-(A- 
139) and (A-60) again follow. The differing values of the probe parameters 
are addressed in Section 4. 

Next consider possibility (L), given by Eqs. (A-50): 

Fi = 0, (A-180) 

F 2 = 0, (A-181) 
F 3 = 0. (A-182) 
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From Eqs. (A-5) and (A- 180), it follows that 



sin 2 2a cos 2 A 



%-l+ZE) 



4(l-E) 2 -c 2 sin 2 2a 



-2{ (2-tan 2 2a) [cot 2 2a-cos 26»(sin 20+cot 2 2a)] +sin 2^[l+(l-tan 2 2a) cos 26»] } 



(A-183) 



sin 2 26 cos 2 20 



From Eqs. (A-10) and (A-181), one gets 



sin 2 2a cos 2 A 



2 (q - 1 + 2E) 
.4(1 - -E) 2 - c 2 sin 2 2a 



-2 (sin 20 + 2 cot 2 2a - 1) 



From Eqs. (A-15) and (A-182), one gets 



cos 26 cos 2 20 



(A- 184) 



sin 2a cos A 



2 (g - 1 + 2g 
4(l-E) 2 -c 2 sin 2 2a 



2(1 - cos 20) 
sin 2 26> sin 20 ' 



(A-185) 



Next equating Eqs. (A-183) and (A-185) leads to 



cos 29 = 1, 



(A-186) 



and Eqs. (A-183) and (A-185) are both identically satisfied. But then sub- 
stituting Eq. (A-186), (67), and (10) in Eq. (A-184), one obtains 



sin 2 2a cos 2 A cos 2 : 



1 + (l - 2 esc 2 2a) E\ = -2 (1 - E'f (sin 20 + 2 cot 2 2a 



(A-187) 



or 



cos 2 A = 



2(1- Ef (1-2 cot 2 2a - sin 20) 
sin 2 2a cos 2 20 [1 + (1 - 2 esc 2 2a) E] ' 



(A-188) 
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Also, substituting Eq. (A-186) in Eq. (66), one obtains 

sin 2fi sin 2 A = 1 - 2E esc 2 2a - cos 2 A sin 20. (A-189) 

Then substituting Eqs. (A-188) and (A-189) in Eqs. (8)-(ll) yields 

a = 1 - 2£csc 2 2a, (A-190) 

b= 1 -2Ecsc 2 2a, (A-191) 

c = 0, (A-192) 

d=l. (A-193) 
Next substituting Eqs. (A-190)-(A-193) in Eq. (62) again leads to 

Q = l + d-2c^2a)fl 

1 — _£/ 

The differing values of the probe parameters are addressed in Section 4. 
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